• Monitor, analyze, and investigate network traffic, system activities, security events, and threat intelligence to identify, detect, and respond to potential cyber threats, attacks, and security incidents.
• Lead the incident response lifecycle by investigating, containing, eradicating, and recovering from security incidents while ensuring timely escalation, evidence preservation, and post-incident reviews.
• Conduct regular risk assessments, vulnerability assessments, security configuration reviews, and compliance audits to identify, assess, and remediate security vulnerabilities, misconfigurations, and operational risks.
• Perform penetration testing, security validation, and attack simulation exercises to proactively identify weaknesses in network infrastructure, systems, applications, and security controls, and recommend remediation measures.
• Prepare comprehensive security incident reports, forensic findings, root cause analyses, risk assessments, and management reports with actionable recommendations to strengthen the organization's security posture.
• Deploy, administer, monitor, and troubleshoot enterprise security infrastructure, including firewalls, Web Application Firewalls, VPN (SSL/IPsec), intrusion prevention systems secure web gateways, encryption technologies, DMZ environments, and endpoint security solutions.
• Monitor, investigate, and respond to endpoint and network threats using Endpoint Detection and Response, Network Detection and Response, and threat intelligence solutions.
• Administer and optimize Security Information and Event Management and Security Orchestration, Automation, and Response (SOAR) platforms by integrating log sources, developing correlation rules, automating incident response, and enhancing threat detection capabilities.
• Secure and monitor identity and access management environments, including Active Directory, Microsoft Entra ID (Azure AD), authentication services, privileged accounts, and identity security controls to detect unauthorized activities and privilege abuse.
• Administer, maintain, and troubleshoot enterprise cybersecurity solutions, including Network Access Control, Zero Trust Network Access, Endpoint Management Systems, Privileged Access Management, Identity and Access Management, Multi-Factor Authentication, and related security platforms.
• Integrate servers, applications, cloud services, security devices, databases, and network infrastructure (Windows, Linux, virtualization, and cloud environments) with SIEM and centralized security monitoring platforms to ensure comprehensive visibility and event correlation.
• Collaborate with IT infrastructure, network, application, core, and business teams to implement security controls, support operational requirements, manage security changes, and ensure compliance with organizational security policies and standards.
• Support the planning, implementation, testing, and continuous improvement of cybersecurity projects, security architectures, compliance initiatives, and technology upgrades while ensuring alignment with business objectives and industry best practices.
• Develop, deliver, and promote cybersecurity awareness programs, user education, phishing simulations, and security best practices to strengthen the organization's overall security culture.
• Continuously monitor emerging cyber threats, vulnerabilities, attack techniques, threat intelligence, and industry best practices, and recommend security enhancements, hardening measures, and proactive improvements to the organization's security posture.
• Perform additional cybersecurity, operational, and project-related responsibilities assigned by management while maintaining compliance with organizational policies, regulatory requirements, and strategic objectives.
